OpenCanary

OpenCanary is free, self-hosted software that acts as a network honeypot, imitating services to detect and alert on interactions after an attacker enters a non-public network. It runs as a daemon and can report a source IP address and a possible location of the breach. Native service modules include SSH, FTP, Git, HTTP and HTTPS, databases, Telnet, SNMP, SIP, VNC, Redis, TFTP, NTP and TCP banners. Alerts can go to files, Syslog, email, HTTP webhooks, Slack, Microsoft Teams or HPFeeds-compatible daemons. Its companion correlator can combine related events, such as repeated login attempts, into one email or SMS alert. The project says its resource requirements are very low; it can run on a Raspberry Pi or a minimally resourced virtual machine. Installation documentation covers Ubuntu and macOS, as well as Docker on Linux hosts using host networking. Linux has the broadest options: SMB monitoring is unavailable on macOS, and portscan monitoring is Linux-only and disabled in Docker. The project advises limiting write access to its configuration file because it is read with root privileges.

OpenCanary offers a range of decoy services and alert destinations, with a companion tool for grouping related events. Consider platform-specific module limits and protect the configuration file when deploying it.

It suits administrators who want a self-hosted decoy for monitoring activity on a non-public network. Linux hosts have the broadest module options.

OpenCanary is a self-hosted network honeypot that imitates services to flag interactions on non-public networks. It best suits defenders comfortable managing a Linux or macOS host and handling security alerts. Its broad decoy and alert options come without software cost, but Linux supports more modules and the configuration file needs strict protection.

Overview

OpenCanary runs as a daemon and alerts when someone interacts with its network-service decoys. Native modules cover SSH, FTP, Git, HTTP, HTTPS, HTTP proxy, MSSQL, MySQL, Telnet, SNMP, SIP, VNC, Redis, TFTP, NTP and TCP banners. Alerts can identify a source IP and indicate where a breach may have occurred, giving defenders useful leads for investigating suspicious access.

Its very low resource requirements make it practical to run on a Raspberry Pi or a minimally resourced virtual machine. That favors teams able to place and maintain decoys on their own infrastructure without dedicating a substantial server. OpenCanary is BSD-licensed open-source software maintained by Thinkst Canary, which also offers a commercial honeypot.

Key features

Alert destinations include files, Syslog, SMTP email, HTTP webhooks, Slack, Microsoft Teams and HPFeeds-compatible daemons. The customizable webhook handler supports GET, POST and PUT, letting teams send event data to an HTTP endpoint. This range is useful when alerts need to fit existing workflows; it also means operators must choose and manage their own destinations.

The companion opencanary-correlator can combine related events, such as repeated individual brute-force login attempts, into a single email or SMS alert. That can reduce repetitive notifications, while requiring a separate tool alongside the honeypot.

Optional SMB monitoring watches Samba logs for files opened in a Windows file share. Optional portscan monitoring uses iptables to detect scans. The SNMP module requires Scapy, and the Windows File Share module requires Samba, so these capabilities bring additional dependencies rather than working as standalone features.

Pricing

OpenCanary costs nothing. The plan is open-source software for self-hosted deployment, with no paid tier or seat-based pricing described. It suits teams able to provide and secure their own host; it does not remove the operational work of deployment, alert routing or configuration management.

Platforms

OpenCanary supports Linux, macOS and self-hosted deployment. Linux has the widest module support: SMB monitoring is unavailable on macOS, and portscan monitoring is Linux-only because it modifies iptables rules. That module is automatically disabled in Dockerized OpenCanary, and its use of iptables rather than nftables may constrain Linux deployments relying on nftables.

The project documents installation on Ubuntu and macOS, as well as Docker deployment on Linux hosts using host networking. When started with uid and gid flags, OpenCanary drops root privileges after binding to its ports. Because it reads its configuration while running with root privileges, the project recommends making that file root-owned and writable only by root; a writable configuration can permit privilege escalation.

Who it's for

OpenCanary is a strong fit for security teams or technically capable operators who want multiple network decoys, low resource needs and flexible alert destinations in a self-managed package. It is less suitable for anyone seeking a managed service, or for deployments that depend on macOS SMB monitoring or Dockerized portscan detection.

Pros and cons

• Pros: A wide set of native service modules lets operators mimic many network-accessible targets with one daemon.
• Pros: Low resource requirements support deployment on modest hardware such as a Raspberry Pi.
• Pros: Multiple alert destinations and event correlation can fit varied workflows and consolidate repeated events.
• Cons: Linux provides the fullest module set; macOS lacks SMB monitoring and portscan monitoring is limited to Linux.
• Cons: Optional modules require dependencies, and portscan monitoring is disabled in Dockerized deployments.
• Cons: Operators must protect the root-readable configuration file to avoid creating a privilege-escalation risk.

Alternatives

Honeypot Software is a useful starting point for comparing this category. Consider Canarytokens instead if you want free tokens deployed through its hosted service and support across mobile, web and desktop platforms. Honeytrap is another free, self-managed Linux option under Apache License 2.0.

Beelzebub is worth considering for a free self-hosted Linux core framework with API support; its plan also includes a free trial. Cowrie is a free BSD-licensed SSH and Telnet honeypot for Linux. Choose Endlessh for a standalone C SSH tarpit, with a default maximum of 4096 clients.

Honeyd is a free GPL-licensed option with Linux and Windows platform support. Dionaea is a free GPLv2+ open-source honeypot for Linux, while Heralding is a free GPL-3.0 licensed Linux honeypot.

Verdict

Choose OpenCanary if you want a free, low-resource honeypot with broad network-service decoys and flexible alert routing, and can manage a self-hosted deployment. Look elsewhere if your required modules do not fit its platform limits or you need someone else to operate the service.